﻿// PE 32+ tool.cpp : 定义应用程序的入口点。
//
#include <tchar.h>
#include "framework.h"
#include "PE 32+ tool.h"
#include "resource.h"
#include <commdlg.h> 
#include <iostream>
#include <Windows.h>
#include <stdlib.h>
#include <commctrl.h>
#include <locale>
#include <wchar.h>
#define MAX_LOADSTRING 80000000
#define MAX_NUM 16*2000
HINSTANCE hInst;                                // 当前实例
WCHAR szTitle[MAX_LOADSTRING];                  // 标题栏文本
WCHAR szWindowClass[MAX_LOADSTRING];            // 主窗口类名
TCHAR szFile[MAX_PATH] = {0};
HWND hEDIT1 ;
HANDLE hFile = new HANDLE();
DWORD dwBytesInBlock;
CHAR* pFileBuf1;
PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNtHeader;
PIMAGE_FILE_HEADER	pFileHeader;
PIMAGE_OPTIONAL_HEADER64 pOptionalHeader;
PIMAGE_SECTION_HEADER pSectionHeader;
PIMAGE_DATA_DIRECTORY pDataDirectory;
DWORD dwSectionNum;
PIMAGE_EXPORT_DIRECTORY pExport;
PIMAGE_IMPORT_DESCRIPTOR pImport;
PIMAGE_BASE_RELOCATION rec;
//DWORD rva_resTable;
//PIMAGE_RESOURCE_DIRECTORY pResTable;
PIMAGE_RESOURCE_DIRECTORY  pResourceDirectory;
DWORD* addrFunc;
DWORD* addrName;
WORD* addrOrdi;
PVOID pbFile;
int flag1 = 404;
char filePath[MAX_NUM];
using namespace std;
// 此代码模块中包含的函数的前向声明:
ATOM                MyRegisterClass(HINSTANCE hInstance);
BOOL                InitInstance(HINSTANCE, int);
LRESULT CALLBACK    WndProc(HWND, UINT, WPARAM, LPARAM);//主窗口
INT_PTR CALLBACK    About(HWND, UINT, WPARAM, LPARAM);
INT_PTR CALLBACK    FileDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//文件头窗口
int file_format_judgement(char filePath[]);//PE32文件
DWORD RVAToFOA(DWORD imageAddr);//输入RVA（内存相对偏移地址），返回FOA（文件偏移地址）
INT_PTR CALLBACK  SecDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//区块表对话框
INT_PTR CALLBACK  DataDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//数据表对话框
INT_PTR CALLBACK ExpDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//导出表对话框
INT_PTR CALLBACK ImpDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//导入表对话框
INT_PTR CALLBACK RecDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//重定位表
INT_PTR CALLBACK ResDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//资源表
INT_PTR CALLBACK IATDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);//IAT
INT_PTR CALLBACK BoundDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);

int APIENTRY wWinMain(_In_ HINSTANCE hInstance,
                     _In_opt_ HINSTANCE hPrevInstance,
                     _In_ LPWSTR    lpCmdLine,
                     _In_ int       nCmdShow)
    // hPrevInstance程序实例句柄， lpCmdLine程序命令行字符串， nCmdShow运行程序初始显示方式
{
    UNREFERENCED_PARAMETER(hPrevInstance);
    UNREFERENCED_PARAMETER(lpCmdLine);

    // TODO: 在此处放置代码。

    // 初始化全局字符串
    LoadStringW(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
    LoadStringW(hInstance, IDC_PE32TOOL, szWindowClass, MAX_LOADSTRING);
    MyRegisterClass(hInstance);

    // 执行应用程序初始化:
    if (!InitInstance (hInstance, nCmdShow))
    {
        return FALSE;
    }

    HACCEL hAccelTable = LoadAccelerators(hInstance, MAKEINTRESOURCE(IDC_PE32TOOL));

    MSG msg;

    // 主消息循环:
    while (GetMessage(&msg, nullptr, 0, 0))
    {
        if (!TranslateAccelerator(msg.hwnd, hAccelTable, &msg))
        {
            TranslateMessage(&msg);
            DispatchMessage(&msg);
        }
    }

    return (int) msg.wParam;
}


//
//  函数: MyRegisterClass()
//
//  目标: 注册窗口类。
//
ATOM MyRegisterClass(HINSTANCE hInstance)
{
    WNDCLASSEXW wcex;

    wcex.cbSize = sizeof(WNDCLASSEX);

    wcex.style          = CS_HREDRAW | CS_VREDRAW;
    wcex.lpfnWndProc    = WndProc;
    wcex.cbClsExtra     = 0;
    wcex.cbWndExtra     = 0;
    wcex.hInstance      = hInstance;
    wcex.hIcon          = LoadIcon(hInstance, MAKEINTRESOURCE(IDI_PE32TOOL));
    wcex.hCursor        = LoadCursor(nullptr, IDC_ARROW);
    wcex.hbrBackground  = (HBRUSH)(COLOR_WINDOW+1);
    wcex.lpszMenuName   = MAKEINTRESOURCEW(IDC_PE32TOOL);
    wcex.lpszClassName  = szWindowClass;
    wcex.hIconSm        = LoadIcon(wcex.hInstance, MAKEINTRESOURCE(IDI_SMALL));

    return RegisterClassExW(&wcex);
}

//
//   函数: InitInstance(HINSTANCE, int)
//
//   目标: 保存实例句柄并创建主窗口
//
//   注释:
//
//        在此函数中，我们在全局变量中保存实例句柄并
//        创建和显示主程序窗口。
//
BOOL InitInstance(HINSTANCE hInstance, int nCmdShow)
{
   hInst = hInstance; // 将实例句柄存储在全局变量中

   HWND hWnd = CreateWindowW(szWindowClass, szTitle, WS_EX_LAYERED | WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX,
       CW_USEDEFAULT, 0, 450, 480, nullptr, nullptr, hInstance, nullptr);
   
   if (!hWnd)
   {
      return FALSE;
   }
  
   ShowWindow(hWnd, nCmdShow);
   UpdateWindow(hWnd);

   return TRUE;
}

//
//  函数: WndProc(HWND, UINT, WPARAM, LPARAM)
//
//  目标: 处理主窗口的消息。
//
//  WM_COMMAND  - 处理应用程序菜单
//  WM_PAINT    - 绘制主窗口
//  WM_DESTROY  - 发送退出消息并返回
//
//
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
    switch (message)
    {
    case WM_CREATE: {
        
        LPCREATESTRUCT pcs = (LPCREATESTRUCT)lParam;
        //创建子控件
        hEDIT1 = CreateWindow("Edit", "FilePath", WS_CHILD | WS_VISIBLE | ES_MULTILINE|ES_NOHIDESEL|ES_READONLY, 20, 20, 400, 20, hWnd, (HMENU)0, pcs->hInstance, NULL);
        HWND Btn1 = CreateWindow("Button", "文件选择", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON, 300, 60, 80, 20, hWnd, (HMENU)1, pcs->hInstance, NULL);
    //    HWND hStatic1 = CreateWindow("Static", "File Header:", WS_CHILD | WS_VISIBLE | SS_SIMPLE, 20, 200, 100, 20, hWnd, (HMENU)2, pcs->hInstance, NULL);
    //    HWND hStatic2 = CreateWindow("Static", "Optional Header:", WS_CHILD | WS_VISIBLE | SS_SIMPLE, 20, 300, 120, 20, hWnd, (HMENU)3, pcs->hInstance, NULL);
    //    HWND hEDIT2 = CreateWindow("Edit", "内容", WS_CHILD | WS_VISIBLE | ES_MULTILINE | ES_NOHIDESEL , 130,190 , 750, 200, hWnd, (HMENU)4, pcs->hInstance, NULL);
        HWND Btn2 = CreateWindow("Button", "文件头", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON, 90, 110, 200, 50, hWnd, (HMENU)5, pcs->hInstance, NULL);
        HWND Btn3 = CreateWindow("Button", "Section", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,90, 180, 200, 50, hWnd, (HMENU)6, pcs->hInstance, NULL);
        HWND Btn4 = CreateWindow("Button", "数据目录表", WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON, 90, 250, 200, 50, hWnd, (HMENU)7, pcs->hInstance, NULL);
 
    }

    case WM_COMMAND:
        {
            int wmId = LOWORD(wParam);
            WORD code = HIWORD(wParam);
            // 分析菜单选择:
             //按钮
            switch (wmId)
            {
            case IDM_ABOUT:
                DialogBox(hInst, MAKEINTRESOURCE(IDD_ABOUTBOX), hWnd, About);
                break;
            case IDM_EXIT:
                DestroyWindow(hWnd);
                break;

            case 1:
                if (code == BN_CLICKED) {
                    
                    OPENFILENAME ofn;      // 公共对话框结构。     
                    //TCHAR szFile[MAX_PATH]; // 保存获取文件名称的缓冲区。               
                    // 初始化选择文件对话框。     
                    ZeroMemory(&ofn, sizeof(OPENFILENAME));
                    ofn.lStructSize = sizeof(OPENFILENAME);
                    ofn.hwndOwner = NULL;
                    ofn.lpstrFile = szFile;
                    ofn.lpstrFile[0] = '\0';
                    ofn.nMaxFile = sizeof(szFile);
                    ofn.lpstrFilter = (LPCSTR)"All(*.*)\0*.*\0";//(LPCWSTR)"All(*.*)\0*.*\0Text(*.txt)\0*.TXT\0\0";
                    ofn.nFilterIndex = 1;
                    ofn.lpstrFileTitle = NULL;
                    ofn.nMaxFileTitle = 0;
                    ofn.lpstrInitialDir = NULL;
                    ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;
                    //ofn.lpTemplateName =  MAKEINTRESOURCE(ID_TEMP_DIALOG);    
                    // 显示打开选择文件对话框。
                    if (GetOpenFileName(&ofn))
                    {
                        //显示选择的文件。 
                        std::wcout << szFile << std::endl;
                        //OutputDebugString(szFile);    //这一句是显示路径吗？为什么不显示？
                        //OutputDebugString((LPCWSTR)"\r\n");
                    }
                    SetWindowText(hEDIT1, szFile);       
                    if (szFile == NULL) {
                        
                        MessageBox(hWnd, "请选取目标文件", "提示", MB_OKCANCEL);

                    }
                    else {
                        flag1 = 0;
                        int flag = 0;
                        flag = file_format_judgement(szFile);
                        if (flag == 2) {

                            wmId = 2;


                        }
                        else if (flag == 3) {
                            MessageBox(hWnd, "是PE文件，但不是PE32+文件！", "提示", MB_OKCANCEL);
                        }

                        else {
                            MessageBox(hWnd, "不是PE文件！", "提示", MB_OKCANCEL);
                        }
                    }
                }
                break;
                //Header
            case 5: {
                if (flag1==404) {

                    MessageBox(hWnd, "请选取目标文件", "提示", MB_OKCANCEL);

                }
                else {
                    //非模态返回窗口句柄
                    HWND hDlg = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG1), hWnd, FileDlgProc);
                    //显示
                    TCHAR str[64];

                    HWND Edit3 = GetDlgItem(hDlg, IDC_EDIT3);
                    //printf("NumberOfSections:%04X\n\n", pFileHeader->NumberOfSections);
                    //SetWindowText(Edit3, "OK");
                    wsprintf(str, "%04X", pFileHeader->NumberOfSections);
                    //SetDlgItemText(hDlg, IDC_EDIT3, str);
                    SetWindowText(Edit3, str);

                    HWND Edit4 = GetDlgItem(hDlg, IDC_EDIT1);
                    wsprintf(str, "%04X", pFileHeader->SizeOfOptionalHeader);
                    SetWindowText(Edit4, str);

                    HWND Edit5 = GetDlgItem(hDlg, IDC_EDIT2);
                    wsprintf(str, "%08X", pFileHeader->TimeDateStamp);
                    SetWindowText(Edit5, str);

                    HWND Edit6 = GetDlgItem(hDlg, IDC_EDIT4);
                    wsprintf(str, "%04X", pFileHeader->Characteristics);
                    SetWindowText(Edit6, str);

                    HWND Edit7 = GetDlgItem(hDlg, IDC_EDIT5);
                    wsprintf(str, "%08X", pOptionalHeader->AddressOfEntryPoint);
                    SetWindowText(Edit7, str);

                    HWND Edit8 = GetDlgItem(hDlg, IDC_EDIT6);
                    wsprintf(str, "%04X", pOptionalHeader->Subsystem);
                    SetWindowText(Edit8, str);


                    HWND Edit9 = GetDlgItem(hDlg, IDC_EDIT8);
                    wsprintf(str, "%016I64X", pOptionalHeader->ImageBase);
                    SetWindowText(Edit9, str);

                    HWND Edit10 = GetDlgItem(hDlg, IDC_EDIT7);
                    wsprintf(str, "%08X", pOptionalHeader->SizeOfImage);
                    SetWindowText(Edit10, str);

                    HWND Edit11 = GetDlgItem(hDlg, IDC_EDIT9);
                    wsprintf(str, "%08X", pOptionalHeader->BaseOfCode);
                    SetWindowText(Edit11, str);

                    HWND Edit12 = GetDlgItem(hDlg, IDC_EDIT10);
                    wsprintf(str, "%08X", pOptionalHeader->SizeOfHeaders);
                    SetWindowText(Edit12, str);

                    HWND Edit13 = GetDlgItem(hDlg, IDC_EDIT11);
                    wsprintf(str, "%08X", pOptionalHeader->SectionAlignment);
                    SetWindowText(Edit13, str);

                    HWND Edit14 = GetDlgItem(hDlg, IDC_EDIT17);
                    wsprintf(str, "%08X", pOptionalHeader->FileAlignment);
                    SetWindowText(Edit14, str);

                    HWND Edit15 = GetDlgItem(hDlg, IDC_EDIT12);
                    wsprintf(str, "%08X", pOptionalHeader->CheckSum);
                    SetWindowText(Edit15, str);

                    HWND Edit16 = GetDlgItem(hDlg, IDC_EDIT18);
                    wsprintf(str, "%08X", pOptionalHeader->NumberOfRvaAndSizes);
                    SetWindowText(Edit16, str);

                    HWND Edit17 = GetDlgItem(hDlg, IDC_EDIT15);
                    wsprintf(str, "%04X", pOptionalHeader->Magic);
                    SetWindowText(Edit17, str);

                    HWND Edit18 = GetDlgItem(hDlg, IDC_EDIT16);
                    wsprintf(str, "%04X", pOptionalHeader->LoaderFlags);
                    SetWindowText(Edit18, str);
                    ShowWindow(hDlg, SW_SHOWNA);

                }
            }
                break;
                //Section
            case 6:
            {
                if (flag1 == 404) {

                    MessageBox(hWnd, "请选取目标文件", "提示", MB_OKCANCEL);

                }
                else {
                    //非模态返回窗口句柄
                    HWND hDlg1 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG2), hWnd, SecDlgProc);
                    //显示
                    //获取区段表头指针
                    pSectionHeader = IMAGE_FIRST_SECTION(pNtHeader);
                    //获取区段个数
                    dwSectionNum = pFileHeader->NumberOfSections;
                    TCHAR str1[64];
                    TCHAR str2[64];
                    TCHAR str3[64];
                    TCHAR str4[64];
                    TCHAR str5[64];
                    //TCHAR str6[256];
                    HWND Edit5 = GetDlgItem(hDlg1, IDC_EDIT5);
                    TCHAR* buf;
                    unsigned int outLength;
                    for (DWORD i = 0; i < dwSectionNum; i++, pSectionHeader++)
                    {
                        for (DWORD j = 0; j < IMAGE_SIZEOF_SHORT_NAME; j++)
                        {

                            wsprintf(str1, "%c", pSectionHeader->Name[j]);

                            // get size to determine buffer size

                            outLength = GetWindowTextLength(Edit5);

                            // create buffer to hold current text in edit control
                            buf = (TCHAR*)GlobalAlloc(GPTR, outLength + 64);

                            // get existing text from edit control and put into buffer
                            GetDlgItemText(hDlg1, IDC_EDIT5, buf, outLength + 64);

                            // append the newText to the buffer
                            _tcscat_s(buf, outLength + 64, str1);

                            // Set the text in the dialog
                            SetDlgItemText(hDlg1, IDC_EDIT5, buf);

                            // SetWindowText(Edit5, str1);                //刷新显示内容
                            //SendMessage(Edit5, EM_SCROLL, SB_BOTTOM, NULL); //滚动条到最底部
                           // printf("%c", pSectionHeader->Name[j]);
                        }
                        wsprintf(str2, "\t\t\t%08X\t  ", pSectionHeader->VirtualAddress);
                        outLength = GetWindowTextLength(Edit5);
                        buf = (TCHAR*)GlobalAlloc(GPTR, outLength + 64);
                        GetDlgItemText(hDlg1, IDC_EDIT5, buf, outLength + 64);
                        _tcscat_s(buf, outLength + 64, str2);
                        SetDlgItemText(hDlg1, IDC_EDIT5, buf);

                        wsprintf(str3, "\t\t %08X\t ", pSectionHeader->Misc.VirtualSize);
                        outLength = GetWindowTextLength(Edit5);
                        buf = (TCHAR*)GlobalAlloc(GPTR, outLength + 64);
                        GetDlgItemText(hDlg1, IDC_EDIT5, buf, outLength + 64);
                        _tcscat_s(buf, outLength + 64, str3);
                        SetDlgItemText(hDlg1, IDC_EDIT5, buf);

                        wsprintf(str4, " \t%08X \t", pSectionHeader->PointerToRawData);
                        outLength = GetWindowTextLength(Edit5);
                        buf = (TCHAR*)GlobalAlloc(GPTR, outLength + 64);
                        GetDlgItemText(hDlg1, IDC_EDIT5, buf, outLength + 64);
                        _tcscat_s(buf, outLength + 64, str4);
                        SetDlgItemText(hDlg1, IDC_EDIT5, buf);

                        wsprintf(str5, "\t %08X\r\n ", pSectionHeader->Characteristics);
                        outLength = GetWindowTextLength(Edit5);
                        buf = (TCHAR*)GlobalAlloc(GPTR, outLength + 64);
                        GetDlgItemText(hDlg1, IDC_EDIT5, buf, outLength + 64);
                        _tcscat_s(buf, outLength + 64, str5);
                        SetDlgItemText(hDlg1, IDC_EDIT5, buf);

                    }//内存中节相对于镜像基址的偏移，加载进内存中节的总大小，节中数据起始文件偏移，节标志
                    ShowWindow(hDlg1, SW_SHOWNA);
                }
            }
            break;
            //DataDirectory
            case 7:
            {
                if (flag1 == 404) {

                    MessageBox(hWnd, "请选取目标文件", "提示", MB_OKCANCEL);

                }
                else {
                    HWND hDlg2 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG3), hWnd, DataDlgProc);
                    pDataDirectory = pOptionalHeader->DataDirectory;
                    HWND Edit55 = GetDlgItem(hDlg2, IDC_EDIT55);
                    TCHAR* buf1;
                    TCHAR str6[64];
                    TCHAR str7[64];
                    TCHAR str8[64];
                    // TCHAR str9[64];
                    unsigned int outLength1;
                    for (DWORD i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++)
                    {
                        wsprintf(str7, "\t%08X\t", pDataDirectory[i].VirtualAddress);
                        outLength1 = GetWindowTextLength(Edit55);
                        buf1 = (TCHAR*)GlobalAlloc(GPTR, outLength1 + 64);
                        GetDlgItemText(hDlg2, IDC_EDIT55, buf1, outLength1 + 64);
                        _tcscat_s(buf1, outLength1 + 64, str7);
                        SetDlgItemText(hDlg2, IDC_EDIT55, buf1);

                        wsprintf(str8, "\t\t %08X\r\n", pDataDirectory[i].Size);
                        outLength1 = GetWindowTextLength(Edit55);
                        buf1 = (TCHAR*)GlobalAlloc(GPTR, outLength1 + 64);
                        GetDlgItemText(hDlg2, IDC_EDIT55, buf1, outLength1 + 64);
                        _tcscat_s(buf1, outLength1 + 64, str8);
                        SetDlgItemText(hDlg2, IDC_EDIT55, buf1);

                        wsprintf(str6, "\r\n");
                        outLength1 = GetWindowTextLength(Edit55);
                        buf1 = (TCHAR*)GlobalAlloc(GPTR, outLength1 + 64);
                        GetDlgItemText(hDlg2, IDC_EDIT55, buf1, outLength1 + 64);
                        _tcscat_s(buf1, outLength1 + 64, str6);
                        SetDlgItemText(hDlg2, IDC_EDIT55, buf1);

                    }

                    ShowWindow(hDlg2, SW_SHOWNA);
                }
            }
                break;
            default:
              return DefWindowProc(hWnd, message, wParam, lParam);
            }
                    
        }
        break;
  
    case WM_PAINT:
        {
            PAINTSTRUCT ps;
            HDC hdc = BeginPaint(hWnd, &ps);
            // TODO: 在此处添加使用 hdc 的任何绘图代码...
            //创建画笔
            HPEN hPEN = CreatePen(PS_DASHDOT, 1, RGB(255, 255, 255));
            //画矩形
            Rectangle(hdc, 10, 10, 425, 50);
            //Rectangle(hdc, 10, 140, 900, 100);
            //Rectangle(hdc, 10, 180, 900, 400);
            EndPaint(hWnd, &ps);
        }
        break;
    
    case WM_DESTROY: {
        UnmapViewOfFile(pFileBuf1);
        CloseHandle(hFile);
        PostQuitMessage(0);
    }
        break;
    default:
        return DefWindowProc(hWnd, message, wParam, lParam);
    }
    return 0;
}

// “关于”框的消息处理程序。
INT_PTR CALLBACK About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
    UNREFERENCED_PARAMETER(lParam);
    switch (message)
    {
    case WM_INITDIALOG:
        return (INT_PTR)TRUE;

    case WM_COMMAND:
        if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL)
        {
            EndDialog(hDlg, LOWORD(wParam));
            return (INT_PTR)TRUE;
        }
        break;
    }
    return (INT_PTR)FALSE;
}
int file_format_judgement(char filePath[]) {
    //获得PE文件句柄
    hFile = CreateFile(filePath, GENERIC_READ| GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  
    //HANDLE hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL); //创建一个新的文件映射内核对象
  //将一个文件映射对象映射到内存,得到指向映射到内存的第一个字节的指针pbFile

       // PVOID pbFile1= new PVOID[dwBytesInBlock];
    //PVOID pbFile1 = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, 0);
    //pbFile = pbFile1;
    if (hFile==NULL ) {
        return 4;
    }
    else {
        dwBytesInBlock = GetFileSize(hFile, NULL); //文件长度

       CHAR* pFileBuf = new CHAR[dwBytesInBlock];
        //将文件读取到内存
       DWORD ReadSize = 0;
       ReadFile(hFile, pFileBuf, dwBytesInBlock, &ReadSize, NULL);
      
        //判断是否为PE文件
        pDosHeader = (PIMAGE_DOS_HEADER)pFileBuf;
       //pDosHeader = (PIMAGE_DOS_HEADER)&pbFile;
        if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
        {

            //printf("\n\t----------不是PE文件 ----------\n");
            //system("pause");
            return 1;
        }
       pNtHeader = (PIMAGE_NT_HEADERS)(pFileBuf + pDosHeader->e_lfanew);
        //pNtHeader = (PIMAGE_NT_HEADERS)(&pbFile + pDosHeader->e_lfanew);
        if (0x00004550 != pNtHeader->Signature)
        {
            //printf("\n\t---------- 不是PE文件 ----------\n");
           if (NULL != pFileBuf)
            //if (NULL != pbFile)
            {
               UnmapViewOfFile(pFileBuf);
               // UnmapViewOfFile(pbFile);
            }

            if (INVALID_HANDLE_VALUE != hFile)
            {
                CloseHandle(hFile);
            }

            UnmapViewOfFile(pFileBuf);
            //UnmapViewOfFile(pbFile);
            CloseHandle(hFile);
            return 1;
        }
        // 获取基本PE头信息
        //获取信息所用到的两个结构体指针	（这两个结构体都属于NT头）
        pFileHeader = &(pNtHeader->FileHeader);

        pOptionalHeader = &(pNtHeader->OptionalHeader);
        pDataDirectory = pOptionalHeader->DataDirectory;
        /**	cout << hex << pFileHeader->Machine<<endl;
            cout << hex << pOptionalHeader->Magic<<endl;
        **/
        if (pFileHeader->Machine == IMAGE_FILE_MACHINE_AMD64 || pOptionalHeader->Magic == 0x20b) {

            //printf("\n\t---------- 是PE32+文件 ----------\n");
            pFileBuf1 = pFileBuf;
            DWORD offset = RVAToFOA(pDataDirectory[0].VirtualAddress);
            pExport = (PIMAGE_EXPORT_DIRECTORY)(pFileBuf + offset);
            pImport = (PIMAGE_IMPORT_DESCRIPTOR)(pFileBuf + RVAToFOA(pDataDirectory[1].VirtualAddress));
            rec = (PIMAGE_BASE_RELOCATION)(pFileBuf + RVAToFOA(pDataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress));
            //pExport = (PIMAGE_EXPORT_DIRECTORY)(&pbFile + offset);
            //pImport = (PIMAGE_IMPORT_DESCRIPTOR)(&pbFile + RVAToFOA(pDataDirectory[1].VirtualAddress));
            //rec = (PIMAGE_BASE_RELOCATION)(&pbFile + RVAToFOA(pDataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress));
            /*
            DWORD* addrFunc = (DWORD*)(pFileBuf + RVAToFOA(pExport->AddressOfFunctions));
            DWORD* addrName = (DWORD*)(pFileBuf + RVAToFOA(pExport->AddressOfNames));
            WORD* addrOrdi = (WORD*)(pFileBuf + RVAToFOA(pExport->AddressOfNameOrdinals));
            */

            //定位资源目录
           pResourceDirectory = (PIMAGE_RESOURCE_DIRECTORY)(pFileBuf  + RVAToFOA(pDataDirectory[2].VirtualAddress));
           // pResourceDirectory = (PIMAGE_RESOURCE_DIRECTORY)(&pbFile + RVAToFOA(pDataDirectory[2].VirtualAddress));
            //DWORD64 Addr = (DWORD64)pResourceDirectory;
            return 2;
        }
        else
        {
            //UnmapViewOfFile(pbFile);
            UnmapViewOfFile(pFileBuf);
            CloseHandle(hFile);
            return 3;
        }
        //pFileBuf1 = pFileBuf;
      //file_header_analysis(pNtHeader, pFileBuf);
      //return 1;
    }
}

//文件头对话框
INT_PTR CALLBACK  FileDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
    //case WM_INITDIALOG:
    
    case WM_COMMAND:
    
        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;
    

    }
    return (INT_PTR)FALSE;
}
//区块表对话框
INT_PTR CALLBACK  SecDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:

    case WM_COMMAND:

        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;


    }
    return (INT_PTR)FALSE;
}
//数据目录表对话框
INT_PTR CALLBACK  DataDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:

    case WM_COMMAND:
    {
        int wmId = LOWORD(wParam);
        WORD code = HIWORD(wParam);
        // 分析菜单选择:
         //按钮
        HWND Btn10 = GetDlgItem(hDlg, IDC_BUTTON10);
        HWND Btn11 = GetDlgItem(hDlg, IDC_BUTTON11);
        HWND Btn12 = GetDlgItem(hDlg, IDC_BUTTON12);
        HWND Btn13 = GetDlgItem(hDlg, IDC_BUTTON13);
        HWND Btn14 = GetDlgItem(hDlg, IDC_BUTTON14);
        HWND Btn15 = GetDlgItem(hDlg, IDC_BUTTON15);
        switch (wmId)
        {
        case IDCANCEL:
            DestroyWindow(hDlg);
           //Export table
        case IDC_BUTTON10:
        {
            if (pDataDirectory[0].VirtualAddress == 0) {
                //printf("\t不存在导出表!\n");
                MessageBox(hDlg, "不存在导出表!", "提示", MB_OKCANCEL);
            }
            else {
                HWND hDlg4 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG4), hDlg, ExpDlgProc);

                DWORD offset = RVAToFOA(pDataDirectory[0].VirtualAddress);

                //PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)(pFileBuf1 + offset);
                TCHAR str11[64];
                TCHAR str12[64];

                HWND Edit25 = GetDlgItem(hDlg4, IDC_EDIT25);
                wsprintf(str11, "%08X", offset);
                SetWindowText(Edit25, str11);

                HWND Edit26 = GetDlgItem(hDlg4, IDC_EDIT26);
                wsprintf(str12, "%08X", pExport->Characteristics);
                SetWindowText(Edit26, str12);

                HWND Edit27 = GetDlgItem(hDlg4, IDC_EDIT27);
                wsprintf(str11, "%08X", pExport->TimeDateStamp);
                SetWindowText(Edit27, str11);

                HWND Edit28 = GetDlgItem(hDlg4, IDC_EDIT28);
                wsprintf(str11, "%04X", pExport->MajorVersion);
                SetWindowText(Edit28, str11);

                HWND Edit29 = GetDlgItem(hDlg4, IDC_EDIT29);
                wsprintf(str11, "%08X", pExport->Name);
                SetWindowText(Edit29, str11);

                HWND Edit30 = GetDlgItem(hDlg4, IDC_EDIT30);
               wsprintf(str11, "%s", (pFileBuf1 + RVAToFOA(pExport->Name)));
               // wsprintf(str11, "%s", (&pbFile + RVAToFOA(pExport->Name)));
                SetWindowText(Edit30, str11);

                HWND Edit31 = GetDlgItem(hDlg4, IDC_EDIT31);
                wsprintf(str11, "%08X", pExport->Base);
                SetWindowText(Edit31, str11);

                HWND Edit32 = GetDlgItem(hDlg4, IDC_EDIT32);
                wsprintf(str11, "%08X", pExport->NumberOfFunctions);
                SetWindowText(Edit32, str11);

                HWND Edit33 = GetDlgItem(hDlg4, IDC_EDIT33);
                wsprintf(str11, "%08X", pExport->NumberOfNames);
                SetWindowText(Edit33, str11);

                HWND Edit34 = GetDlgItem(hDlg4, IDC_EDIT34);
                wsprintf(str11, "%08X", pExport->AddressOfFunctions);
                SetWindowText(Edit34, str11);

                HWND Edit35 = GetDlgItem(hDlg4, IDC_EDIT35);
                wsprintf(str11, "%08X", pExport->AddressOfNames);
                SetWindowText(Edit35, str11);

                HWND Edit36 = GetDlgItem(hDlg4, IDC_EDIT36);
                wsprintf(str11, "%08X", pExport->AddressOfNameOrdinals);
                SetWindowText(Edit36, str11);

                HWND Edit37 = GetDlgItem(hDlg4, IDC_EDIT37);
                TCHAR* buf2;
                int outLength2;
                TCHAR str15[256];
                TCHAR str16[256];
                TCHAR str17[256];
                TCHAR str18[256];
                TCHAR str19[256];
                TCHAR str20[256];
                int length;
                // get size to determine buffer size
                length = strlen("Ordina\t\t\t\tfunc_FOA\t\t\t\tname_FOA\t\tFunctionName\r\n") + 1;
                outLength2 = GetWindowTextLength(Edit37);
                // create buffer to hold current text in edit control
                buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                // get existing text from edit control and put into buffer
                GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                // append the newText to the buffer
                _tcscat_s(buf2, outLength2 + length, "Ordina\t\t\t\tfunc_FOA\t\t\t\tname_FOA\t\tFunctionName\r\n");
                // Set the text in the dialog
                SetDlgItemText(hDlg4, IDC_EDIT37, buf2);
               DWORD* addrFunc = (DWORD*)(pFileBuf1 + RVAToFOA(pExport->AddressOfFunctions));
                DWORD* addrName = (DWORD*)(pFileBuf1 + RVAToFOA(pExport->AddressOfNames));
                WORD* addrOrdi = (WORD*)(pFileBuf1 + RVAToFOA(pExport->AddressOfNameOrdinals));
                //DWORD* addrFunc = (DWORD*)(&pbFile + RVAToFOA(pExport->AddressOfFunctions));
                //DWORD* addrName = (DWORD*)(&pbFile + RVAToFOA(pExport->AddressOfNames));
                //WORD* addrOrdi = (WORD*)(&pbFile + RVAToFOA(pExport->AddressOfNameOrdinals));
                DWORD i, j;
                for ( i = 0; i < pExport->NumberOfFunctions; i++) {//导出时序号有NumberOfFunctions个
                    if (addrFunc[i] == 0) {
                        continue;//地址值为0代表该序号没有对应的函数，是空余的
                    }
                    for ( j = 0; j < pExport->NumberOfNames; j++) {//序号表序号有NumberOfNames个
                        if (addrOrdi[j] == i) {//序号表的值为地址表的索引
                            char* FunctionName = new char[2048];
                           FunctionName = (&pFileBuf1[0] + addrName[j]);
                            //FunctionName =(char*) (&pbFile+ addrName[j]);
                            wsprintf(str15, "%04X\t\t\t\t", i + pExport->Base);
                            length = strlen(str15) + 1;
                            outLength2 = GetWindowTextLength(Edit37);
                            buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                            GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                            _tcscat_s(buf2, outLength2 + length, str15);
                            SetWindowText(Edit37, buf2);

                            wsprintf(str16, "%08X\t\t\t\t", addrFunc[j]);
                            length = strlen(str16) + 1;
                            outLength2 = GetWindowTextLength(Edit37);
                            buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                            GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                            _tcscat_s(buf2, outLength2 + length, str16);
                            SetDlgItemText(hDlg4, IDC_EDIT37, buf2);

                            wsprintf(str17, "%08X\t\t", addrName[j]);
                            outLength2 = GetWindowTextLength(Edit37);
                            length = strlen(str17) + 1;
                            buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                            GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                            _tcscat_s(buf2, outLength2 + length, str17);
                            SetDlgItemText(hDlg4, IDC_EDIT37, buf2);

                            wsprintf(str18, "%s\r\n", (char*)(pFileBuf1 + RVAToFOA(addrName[j])));
                            //wsprintf(str18, "%s\r\n", (char*)(&pbFile + RVAToFOA(addrName[j])));
                            outLength2 = GetWindowTextLength(Edit37);
                            length = strlen(str18) + 1;
                            buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                            GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                            _tcscat_s(buf2, outLength2 + length, str18);
                            SetDlgItemText(hDlg4, IDC_EDIT37, buf2);
                            break;
                        }
                        //cout << pFileBuf << endl;
                    }
                    //存在addrOrdi[j]时,i(索引)等于addrOrdi[j](值),不存在，则i依旧有效,i+Base依旧是序号
                    if (j != pExport->NumberOfNames) {
                        continue;//在序号表中找到
                    }
                    else {//如果在序号表中没有找到地址表的索引，说明函数导出是以地址导出的，匿名函数
                        //printf("%04X\t%08X\t%s\t%s\n", i + pExport->Base, addrFunc[i], "--------", "--------");
                       
                        wsprintf(str15, "%04X\t\t\t\t", i + pExport->Base);
                        outLength2 = GetWindowTextLength(Edit37);
                        length = strlen(str15)+1;
                        buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length );
                        GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                        _tcscat_s(buf2, outLength2 + length, str15);
                        SetDlgItemText(hDlg4, IDC_EDIT37, buf2);

                        wsprintf(str16, "%08X\t\t\t\t", addrFunc[i]);
                        outLength2 = GetWindowTextLength(Edit37);
                        length = strlen(str16)+1;
                        buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                        GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                        _tcscat_s(buf2, outLength2 + length, str16);
                        SetDlgItemText(hDlg4, IDC_EDIT37, buf2);

                        wsprintf(str19, "%s\t\t\t", "--------");
                        outLength2 = GetWindowTextLength(Edit37);
                        length = strlen(str19)+1;
                        buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                        GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                        _tcscat_s(buf2, outLength2 + length, str19);
                        SetDlgItemText(hDlg4, IDC_EDIT37, buf2);

                        wsprintf(str20, "%s\r\n", "--------");
                        outLength2 = GetWindowTextLength(Edit37);
                        length = strlen(str20)+1;
                        buf2 = (TCHAR*)GlobalAlloc(GPTR, outLength2 + length);
                        GetDlgItemText(hDlg4, IDC_EDIT37, buf2, outLength2 + length);
                        _tcscat_s(buf2, outLength2 + length, str20);
                        SetDlgItemText(hDlg4, IDC_EDIT37, buf2);
                        
                    }
                }
                ShowWindow(hDlg4, SW_SHOWNA);
            }
        }
            break;
            //import table
        case IDC_BUTTON11: {
            if (pDataDirectory[1].VirtualAddress == 0) {
                //printf("\t不存在导入表!\n");
                MessageBox(hDlg, "不存在导入表!", "提示", MB_OKCANCEL);
            }
            else {
                HWND hDlg5 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG5), hDlg, ImpDlgProc);

                DWORD offset = RVAToFOA(pDataDirectory[1].VirtualAddress);
                HWND Edit60 = GetDlgItem(hDlg5, IDC_EDIT60);
                TCHAR* buf3;
               // TCHAR str21[256];
                TCHAR str22[256];
                TCHAR str23[256];
                TCHAR str24[256];
                TCHAR str25[256];
                int outLength3;
                int length1;
                // get size to determine buffer size
                length1 = strlen("Name\t\t\t\tNameAddr\t\t\tOriginalFirstThunk\t\t\tFirstThunk\r\n") + 1;
                outLength3 = GetWindowTextLength(Edit60);
                // create buffer to hold current text in edit control
                buf3 = (TCHAR*)GlobalAlloc(GPTR, outLength3 + length1);
                // get existing text from edit control and put into buffer
                GetDlgItemText(hDlg5, IDC_EDIT60, buf3, outLength3 + length1);
                // append the newText to the buffer
                _tcscat_s(buf3, outLength3 + length1, "Name\t\t\t\tNameAddr\t\t\tOriginalFirstThunk\t\t\tFirstThunk\r\n");
                // Set the text in the dialog
                SetDlgItemText(hDlg5, IDC_EDIT60, buf3);
                HWND Edit61 = GetDlgItem(hDlg5, IDC_EDIT61);
                TCHAR* buf4;
                TCHAR str26[256];
                TCHAR str27[256];
                TCHAR str28[256];
                TCHAR str29[256];
                //TCHAR str30[256];
                int outLength4;
                int length2;
                // printf("ThunkOffset\t\tThunkValue\t\tHint\t\tAPI Name\n");
                length2 = strlen("ThunkOffset\t\t\t\tThunkValue\t\t\tHint\t\t\tAPI Name\r\n") + 1;
                outLength4 = GetWindowTextLength(Edit61);
                buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                _tcscat_s(buf4, outLength4 + length2, "ThunkOffset\t\t\t\tThunkValue\t\t\tHint\t\t\tAPI Name\r\n");
                SetDlgItemText(hDlg5, IDC_EDIT61, buf4);
                while (true) {
                    if (pImport->Characteristics == 0) {
                        break;//最后一个结构体20字节为0则结束(直接判断一个Characteristics即可)
                    }
                    DWORD name = RVAToFOA(pImport->Name);
                    DWORD OriginalFirstThunk = RVAToFOA(pImport->OriginalFirstThunk);
                    DWORD FirstThunk = RVAToFOA(pImport->FirstThunk);

                    //打印结构体信息
                    /*
                    printf("【Name:%s】\n"
                        "【NameAddr:%08X】\n"
                        "【OriginalFirstThunk:%08X】\n"
                        "【FirstThunk:%08X】\n"
                        "【TimeDateStamp:%08X】\n",
                        pFileBuf1 + name, name, OriginalFirstThunk, FirstThunk, pImport->TimeDateStamp);
*/
                    wsprintf(str22, "%s", pFileBuf1 + name);
                   // wsprintf(str22, "%s", &pbFile + name);
                    length1 = strlen(str22) + 1;
                    outLength3 = GetWindowTextLength(Edit60);
                    buf3 = (TCHAR*)GlobalAlloc(GPTR, outLength3 + length1);
                    GetDlgItemText(hDlg5, IDC_EDIT60, buf3, outLength3 + length1);
                    _tcscat_s(buf3, outLength3 + length1, str22);
                    SetWindowText(Edit60, buf3);

                    wsprintf(str23, "\t\t\t%08X\t\t\t", name);
                    length1 = strlen(str23) + 1;
                    outLength3 = GetWindowTextLength(Edit60);
                    buf3 = (TCHAR*)GlobalAlloc(GPTR, outLength3 + length1);
                    GetDlgItemText(hDlg5, IDC_EDIT60, buf3, outLength3 + length1);
                    _tcscat_s(buf3, outLength3 + length1, str23);
                    SetWindowText(Edit60, buf3);

                    wsprintf(str24, "%08X\t\t\t", OriginalFirstThunk);
                    length1 = strlen(str24) + 1;
                    outLength3 = GetWindowTextLength(Edit60);
                    buf3 = (TCHAR*)GlobalAlloc(GPTR, outLength3 + length1);
                    GetDlgItemText(hDlg5, IDC_EDIT60, buf3, outLength3 + length1);
                    _tcscat_s(buf3, outLength3 + length1, str24);
                    SetWindowText(Edit60, buf3);

                    wsprintf(str25, "%08X\r\n", FirstThunk);
                    length1 = strlen(str25) + 1;
                    outLength3 = GetWindowTextLength(Edit60);
                    buf3 = (TCHAR*)GlobalAlloc(GPTR, outLength3 + length1);
                    GetDlgItemText(hDlg5, IDC_EDIT60, buf3, outLength3 + length1);
                    _tcscat_s(buf3, outLength3 + length1, str25);
                    SetWindowText(Edit60, buf3);
                   IMAGE_THUNK_DATA64* pthunk = (IMAGE_THUNK_DATA64*)(pFileBuf1 + OriginalFirstThunk);
                   // IMAGE_THUNK_DATA64* pthunk = (IMAGE_THUNK_DATA64*)(&pbFile + OriginalFirstThunk);
                    //打印INT表的详细信息
                    //Print_INT(pthunk, pFileBuf1);
                    //Print_IAT(pDataDirectory, pFileBuf1);
                   
                    while (true) {
                        DWORD thunkValue = pthunk->u1.AddressOfData;
                        if (thunkValue == 0) {
                            break;//读取完毕
                        }
                        if (thunkValue >> 63) {//最高位为1打印序号
                            DWORD rva = thunkValue & 0X7FFFFFFFFFFFFFFF;//去掉最高位才是实际的值,否则RVAToFOA会出错
                            DWORD offset = RVAToFOA(rva);
                            //printf("[%08X]\t\t[%08X]\t\t[--]\t\t函数序号[%04XH:%dD]\n", offset, offset, rva, rva);
                            wsprintf(str26, "%08X\t\t\t\t", offset);
                            length2 = strlen(str26) + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, str26);
                            SetWindowText(Edit61, buf4);

                            wsprintf(str27, "%08X\t\t\t", offset);
                            length2 = strlen(str27) + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, str27);
                            SetWindowText(Edit61, buf4);

                  
                            length2 = strlen("[--]\t\t\t") + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, "[--]\t\t\t");
                            SetWindowText(Edit61, buf4);

                            wsprintf(str28, "%04XH:%dD\r\n", (rva, rva));
                            length2 = strlen(str28) + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, str28);
                            SetWindowText(Edit61, buf4);

                        }
                        else {//最高位为0打印名称
                            DWORD offset = RVAToFOA(thunkValue);
                            //获取IMAGE_IMPORT_BY_NAME的地址
                             IMAGE_IMPORT_BY_NAME* byName = (IMAGE_IMPORT_BY_NAME*)(pFileBuf1 + offset);
                            //IMAGE_IMPORT_BY_NAME* byName = (IMAGE_IMPORT_BY_NAME*)(&pbFile + offset);
                            //printf("[%08X]\t\t[%08X]\t\t[%04X]\t\t%s\n", offset, offset, byName->Hint, byName->Name);
                            wsprintf(str26, "%08X\t\t\t\t", offset);
                            length2 = strlen(str26) + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, str26);
                            SetWindowText(Edit61, buf4);

                            wsprintf(str27, "%08X\t\t\t", offset);
                            length2 = strlen(str27) + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, str27);
                            SetWindowText(Edit61, buf4);

                            wsprintf(str28, "%04X\t\t\t", byName->Hint);
                            length2 = strlen(str28) + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, str28);
                            SetWindowText(Edit61, buf4);

                            wsprintf(str29, "%s\r\n", byName->Name);
                            length2 = strlen(str29) + 1;
                            outLength4 = GetWindowTextLength(Edit61);
                            buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                            GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                            _tcscat_s(buf4, outLength4 + length2, str29);
                            SetWindowText(Edit61, buf4);


                        }
                        pthunk++;
                    }
                    length2 = strlen("----------------------------------------------------------------------------------------------------------------------\r\n") + 1;
                    outLength4 = GetWindowTextLength(Edit61);
                    buf4 = (TCHAR*)GlobalAlloc(GPTR, outLength4 + length2);
                    GetDlgItemText(hDlg5, IDC_EDIT61, buf4, outLength4 + length2);
                    _tcscat_s(buf4, outLength4 + length2, "----------------------------------------------------------------------------------------------------------------------\r\n");
                    SetWindowText(Edit61, buf4);
                    pImport++;
                }
                ShowWindow(hDlg5, SW_SHOWNA);
            }
        }
            
            break;
            //resource table
        case IDC_BUTTON12: {
            if (pDataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress == 0) {
                MessageBox(hDlg, "不存在资源表！", "提示", MB_OKCANCEL);
                
                //return;
            }
            HWND hDlg7 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG7), hDlg, ResDlgProc);
            //HWND Edit80 = GetDlgItem(hDlg7, IDC_EDIT80);
            //定义一个名称数组
            static char* szResName[0x11] =

            { 0,(char*)"鼠标指针",(char*)"位图",(char*)"图标",(char*)"菜单",(char*)"对话框",(char*)"字符串列表",

            (char*)"字体目录", (char*)"字体",(char*)"快捷键", (char*)"非格式化资源",(char*)"消息列表",
            (char*)"鼠标指针组",(char*)"zz", (char*)"图标组", (char*)"xx",(char*)"版本信息"
            };
            //获取RESOURCEENTRY 的个数

            size_t NumEntry = pResourceDirectory->NumberOfIdEntries + pResourceDirectory->NumberOfNamedEntries;

            //资源目录表的宽度

            size_t dwResourceData = sizeof(PIMAGE_RESOURCE_DIRECTORY);

            //定位资源目录节点

            PIMAGE_RESOURCE_DIRECTORY_ENTRY pResEntry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(pResourceDirectory + 1);
            HWND Edit80 = GetDlgItem(hDlg7, IDC_EDIT80);
            TCHAR* buf11;
            char str40[1024];
            //TCHAR str41[1024];
            //TCHAR str42[1024];
           // char str43[1024];
            int outLength5;
            int length3;
            int num = 1;
            //获取第一层
            for (size_t i = 0; i < NumEntry; i++)
            {
                if (!pResEntry[i].NameIsString) {//0
                    if (pResEntry[i].Id < 0x11)
                        //如果id大于0x11就是自己写的ID资源
                    {

                      //  printf("资源类型ID:%x %s\n", pResEntry[i].Id, szResName[pResEntry[i].Id]);
                        wsprintf(str40, "资源类型ID:%x %s\r\n\r\n", pResEntry[i].Id, szResName[pResEntry[i].Id]);
                        length3 = strlen(str40) + 1;
                        outLength5 = GetWindowTextLength(Edit80);
                        buf11= (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
                        GetDlgItemText(hDlg7, IDC_EDIT80, buf11, outLength5+ length3);
                        _tcscat_s(buf11, outLength5 + length3, str40);
                        SetWindowText(Edit80, buf11);
                    }
                    else {
                        char  type[20];
                        sprintf_s(type, "%d", pResEntry[i].Id);
                       // printf("资源类型ID:%x %s\n", pResEntry[i].Id, type);
                        wsprintf(str40, "资源类型ID:%x %s\r\n\r\n", pResEntry[i].Id, type);
                        length3 = strlen(str40) + 1;
                        outLength5 = GetWindowTextLength(Edit80);
                        buf11 = (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
                        GetDlgItemText(hDlg7, IDC_EDIT80, buf11, outLength5 + length3);
                        _tcscat_s(buf11, outLength5 + length3, str40);
                        SetWindowText(Edit80, buf11);
                    }
                }
                else {//1那么这个第一个联合体的最高位为1，也就是说NameIsString为1，如果资源是未知的，这种资源属于字符串作为资源标识， Name就不会起作用了，NameOffset会指向IMAGE_RESOUCE_DIR_STRING_U的位置

                    //先获取偏移
                   PIMAGE_RESOURCE_DIR_STRING_U pStringRes = (PIMAGE_RESOURCE_DIR_STRING_U)(pResourceDirectory + pResEntry[i].NameOffset);
                    //定义一个用来接收自定义字符串的宽数组然后直接复制
                   //WCHAR* Buff = new WCHAR[pStringRes->Length + 1];
                   //memset(Buff, 0, (pStringRes->Length + 1) * 2);
                   //wcsncpy_s(Buff, pStringRes->Length + 1, pStringRes->NameString, pStringRes->Length);
                   // printf("资源名称：%ls \n", szStr);
                   //获取转换所需的目标缓存大小
                   //DWORD dBufSize = WideCharToMultiByte(CP_ACP, 0, pStringRes->NameString, -1, NULL, 0, NULL, FALSE);
                   //分配目标缓存
                   //char* dBuf = new char[dBufSize];
                   //memset(dBuf, 0, dBufSize);
                   //转换
                   //int nRet = WideCharToMultiByte(CP_ACP, 0, pStringRes->NameString, -1, dBuf, dBufSize, NULL, FALSE);
                   //wcstombs_s(&converted, CStr, len, Buff, _TRUNCATE);
                    wsprintf(str40,"自定义资源%d\r\n\r\n",num);
                    length3 = strlen(str40) + 1;
                    outLength5 = GetWindowTextLength(Edit80);
                    buf11 = (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
                    GetDlgItemText(hDlg7, IDC_EDIT80, buf11, outLength5 + length3);
                    _tcscat_s(buf11, outLength5 + length3, str40);
                    SetWindowText(Edit80, buf11);
                    num++;
                }

            }
            ShowWindow(hDlg7, SW_SHOWNA);
            


        }
            
            break;
            //重定位
        case IDC_BUTTON13: {
            if (pDataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress == 0) {
                MessageBox(hDlg, "不存在重定位表！", "提示", MB_OKCANCEL);
                // printf("\t不存在重定位表!\n");
                //return;
            }
            BYTE secName[9] = { 0 };
            HWND hDlg6 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG6), hDlg, RecDlgProc);
            HWND Edit70 = GetDlgItem(hDlg6, IDC_EDIT70);
            HWND Edit71 = GetDlgItem(hDlg6, IDC_EDIT71);
            TCHAR* buf6;
            TCHAR* buf5;
            int outLength5;
            int length3;
            int outLength6;
            int length4;
            TCHAR str31[256];
            TCHAR str32[256];
            TCHAR str33[256];
            TCHAR str34[256];
            TCHAR str35[256];
            TCHAR str36[256];
            TCHAR str37[256];
           // TCHAR str38[256];
           // TCHAR str39[256];
            length3 = strlen("Index\t\t\tsection\t\t\tOffset\t\t\t\tItems\t\t\t\r\n") + 1;
            outLength5 = GetWindowTextLength(Edit70);
            buf5 = (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
            GetDlgItemText(hDlg6, IDC_EDIT70, buf5, outLength5 + length3);
            _tcscat_s(buf5, outLength5 + length3, "Index\t\t\tsection\t\t\tOffset\t\t\t\tItems\t\t\t\r\n");
            SetDlgItemText(hDlg6, IDC_EDIT70, buf5);
            length4 = strlen("index\t\t\t\toffset\t\t\t\ttype\t\t\t\r\n") + 1;
            outLength6 = GetWindowTextLength(Edit71);
            buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
            GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
            _tcscat_s(buf6, outLength6 + length4, "index\t\t\t\toffset\t\t\t\ttype\t\t\t\r\n");
            SetDlgItemText(hDlg6, IDC_EDIT71, buf6);
            for (int i = 1; rec->SizeOfBlock && rec->VirtualAddress; i++) {
                DWORD foa = RVAToFOA(rec->VirtualAddress);
                DWORD size = (rec->SizeOfBlock - 8) / 2;
                //确定该结构体所处节，并获取节名称
                IMAGE_SECTION_HEADER* section = pSectionHeader;
                for (int t = 0; t < dwSectionNum; t++) {
                    DWORD lower = RVAToFOA(section[t].VirtualAddress);
                    DWORD upper = RVAToFOA(section[t].VirtualAddress) + section[t].Misc.VirtualSize;
                    if (foa >= lower && foa <= upper) {
                        memcpy(secName, section[t].Name, 8);
                        break;
                    }
                }
                //打印该页主要信息
               // printf("Index[%d]\tsection[%s]\tOffset[%08X]\tItems[%dD:%XH]\t【Block】\n", i, secName, foa, size, size);
                wsprintf(str31, "%d\t\t\t", i);
                length3 = strlen(str31) + 1;
                outLength5 = GetWindowTextLength(Edit70);
                buf5 = (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
                GetDlgItemText(hDlg6, IDC_EDIT70, buf5, outLength5 + length3);
                _tcscat_s(buf5, outLength5 + length3, str31);
                SetDlgItemText(hDlg6, IDC_EDIT70, buf5);

                wsprintf(str32, "%s\t\t\t", secName);
                length3 = strlen(str32) + 1;
                outLength5 = GetWindowTextLength(Edit70);
                buf5 = (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
                GetDlgItemText(hDlg6, IDC_EDIT70, buf5, outLength5 + length3);
                _tcscat_s(buf5, outLength5 + length3, str32);
                SetDlgItemText(hDlg6, IDC_EDIT70, buf5);

                wsprintf(str33, "%08X\t\t\t", foa);
                length3 = strlen(str33) + 1;
                outLength5 = GetWindowTextLength(Edit70);
                buf5 = (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
                GetDlgItemText(hDlg6, IDC_EDIT70, buf5, outLength5 + length3);
                _tcscat_s(buf5, outLength5 + length3, str33);
                SetDlgItemText(hDlg6, IDC_EDIT70, buf5);
                
                wsprintf(str34, "%dD:%XH\t\t\t\r\n", (size,size));
                length3 = strlen(str34) + 1;
                outLength5 = GetWindowTextLength(Edit70);
                buf5 = (TCHAR*)GlobalAlloc(GPTR, outLength5 + length3);
                GetDlgItemText(hDlg6, IDC_EDIT70, buf5, outLength5 + length3);
                _tcscat_s(buf5, outLength5 + length3, str34);
                SetDlgItemText(hDlg6, IDC_EDIT70, buf5);

                //打印一个页中所有重定位地址与信息
                
                WORD* recAddr = (WORD*)((BYTE*)rec + 8);//recAddr指向重定位表结构体后的首字节
                //printf("index\toffset\t\ttype\t【Block Items】\n");
                for (DWORD j = 0; j < size; j++) {
                    DWORD offset = (recAddr[j] & 0X0FFF) + foa;//低四位是偏移地址
                    WORD type = recAddr[j] >> 12;//高四位是有效判断位
                    if (type == 0) {
                      //  printf("[%d] \t[--------]\tABSOLUTE[%d]\n", j + 1, type);
                        wsprintf(str35, "%d\t\t\t\t", j + 1);
                        length4 = strlen(str35) + 1;
                        outLength6 = GetWindowTextLength(Edit71);
                        buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
                        GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
                        _tcscat_s(buf6, outLength6 + length4, str35);
                        SetDlgItemText(hDlg6, IDC_EDIT71, buf6);

                        //wsprintf(str35, "%d\t\t\t\t", j + 1);
                        length4 = strlen("[--------]\t\t\t\t") + 1;
                        outLength6 = GetWindowTextLength(Edit71);
                        buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
                        GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
                        _tcscat_s(buf6, outLength6 + length4, "[--------]\t\t\t\t");
                        SetDlgItemText(hDlg6, IDC_EDIT71, buf6);

                        wsprintf(str37, "ABSOLUTE[%d]\t\t\t\r\n", type);
                        length4 = strlen(str37) + 1;
                        outLength6 = GetWindowTextLength(Edit71);
                        buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
                        GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
                        _tcscat_s(buf6, outLength6 + length4, str37);
                        SetDlgItemText(hDlg6, IDC_EDIT71, buf6);
                        continue;
                    }
                  //  printf("[%d] \t[%08X]\tHIGHLOW[%d]\n", j + 1, offset, type);
                    wsprintf(str35, "%d\t\t\t\t", j + 1);
                    length4 = strlen(str35) + 1;
                    outLength6 = GetWindowTextLength(Edit71);
                    buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
                    GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
                    _tcscat_s(buf6, outLength6 + length4, str35);
                    SetDlgItemText(hDlg6, IDC_EDIT71, buf6);

                    wsprintf(str36, "%08X\t\t\t", offset);
                    length4 = strlen(str36) + 1;
                    outLength6 = GetWindowTextLength(Edit71);
                    buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
                    GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
                    _tcscat_s(buf6, outLength6 + length4, str36);
                    SetDlgItemText(hDlg6, IDC_EDIT71, buf6);

                    wsprintf(str37, "HIGHLOW[%d]\t\t\t\r\n", type);
                    length4 = strlen(str37) + 1;
                    outLength6 = GetWindowTextLength(Edit71);
                    buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
                    GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
                    _tcscat_s(buf6, outLength6 + length4, str37);
                    SetDlgItemText(hDlg6, IDC_EDIT71, buf6);
                }
                length4 = strlen("--------------------------------------------------------------------------------\r\n") + 1;
                outLength6 = GetWindowTextLength(Edit71);
                buf6 = (TCHAR*)GlobalAlloc(GPTR, outLength6 + length4);
                GetDlgItemText(hDlg6, IDC_EDIT71, buf6, outLength6 + length4);
                _tcscat_s(buf6, outLength6 + length4, "--------------------------------------------------------------------------------\r\n");
                SetDlgItemText(hDlg6, IDC_EDIT71, buf6);
                memset(secName, 0, 9);
                rec = (IMAGE_BASE_RELOCATION*)((BYTE*)rec + rec->SizeOfBlock);//进行下一页的判断
                
            }
            ShowWindow(hDlg6, SW_SHOWNA);
        }

        break;
        //IAT
        case IDC_BUTTON14: {
            if (pDataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress == 0) {
                MessageBox(hDlg, "不存在IAT表!", "提示", MB_OKCANCEL);
                // printf("\t不存在重定位表!\n");
                //return;
            }
            else
            {
                HWND hDlg9 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG9), hDlg, IATDlgProc);
                HWND Edit90 = GetDlgItem(hDlg9, IDC_EDIT90);

                while (true) {
                    if (pImport->Characteristics == 0) {
                        //MessageBox(hDlg, "不存在IAT表!", "提示", MB_OKCANCEL);
                        break;
                    }

                    DWORD* addr = (DWORD*)(pFileBuf1 + RVAToFOA(pImport->FirstThunk));
                    //根据导入表的时间戳判断IAT中存放的是函数地址还是名字结构体的地址
                    if (pImport->TimeDateStamp == -1) {//函数地址
                        
                        int length7;
                        int outLength7;
                        TCHAR* buf9;
                        // printf("\tdllName:【%s】:\n", pFileBuf1 + RVAToFOA(pImport->Name));
                        TCHAR str90[256];
                        TCHAR str91[256];
                        wsprintf(str91, "dllName:【%s】:\r\n", pFileBuf1 + RVAToFOA(pImport->Name));
                        length7 = strlen(str90) + 1;
                        outLength7 = GetWindowTextLength(Edit90);
                        buf9 = (TCHAR*)GlobalAlloc(GPTR, outLength7 + length7);
                        GetDlgItemText(hDlg9, IDC_EDIT70, buf9, outLength7 + length7);
                        _tcscat_s(buf9, outLength7 + length7, str91);
                        SetDlgItemText(hDlg9, IDC_EDIT70, buf9);
                        for (int i = 0; addr[i]; i++) {
                            // printf("\t\tFunction Addr:[%08X]\n", addr[i]);
                            wsprintf(str90, "\t\tFunction Addr:[%08X]\r\n", addr[i]);
                            length7 = strlen(str90) + 1;
                            outLength7 = GetWindowTextLength(Edit90);
                            buf9 = (TCHAR*)GlobalAlloc(GPTR, outLength7 + length7);
                            GetDlgItemText(hDlg9, IDC_EDIT70, buf9, outLength7 + length7);
                            _tcscat_s(buf9, outLength7 + length7, str90);
                            SetDlgItemText(hDlg9, IDC_EDIT70, buf9);
                        }
                        ShowWindow(hDlg9, SW_SHOWNA);
                    }
                    else if (pImport->TimeDateStamp == 0) {//等同于INT表
                        //printf("\t等同于INT表!\n");
                        MessageBox(hDlg, "等同于INT表!", "提示", MB_OKCANCEL);
                        break;
                    }
                    pImport++;
                }
                
            }
            
        }

                         break;
        //BOUND
        case IDC_BUTTON15: {
            if (pDataDirectory[11].VirtualAddress == 0) {
                MessageBox(hDlg, "不存在绑定导入表!", "提示", MB_OKCANCEL);
            }
            DWORD desAddr = pDataDirectory[11].VirtualAddress;//获取第一个Bound Import Descriptor的RVA
            char str[32] = { 0 };
            DWORD stamp = 0, off = 0, ref = 0, i = 0;

            IMAGE_BOUND_IMPORT_DESCRIPTOR* pbound = (IMAGE_BOUND_IMPORT_DESCRIPTOR*)(pFileBuf1 + RVAToFOA(desAddr));
            HWND hDlg10 = CreateDialog(GetModuleHandle(NULL), MAKEINTRESOURCE(IDD_DIALOG10), hDlg, BoundDlgProc);
            HWND Edit100 = GetDlgItem(hDlg10, IDC_EDIT100);
            HWND Edit101 = GetDlgItem(hDlg10, IDC_EDIT101);
            TCHAR* buf10;
            TCHAR* buf11;
            TCHAR str100[MAX_NUM];
            TCHAR str101[MAX_NUM];
            int length10 = strlen("DllName\t\tTimeDateStamp\t\tOffsetModuleName\t\tNumberOfModuleForwarderRefs\r\n") + 1;
            int outLength10 = GetWindowTextLength(Edit100);
            buf10 = (TCHAR*)GlobalAlloc(GPTR, outLength10 + length10);
            GetDlgItemText(hDlg10, IDC_EDIT100, buf10, outLength10 + length10);
            _tcscat_s(buf10, outLength10 + length10, "DllName\t\tTimeDateStamp\t\tOffsetModuleName\t\tNumberOfModuleForwarderRefs\r\n");
            SetDlgItemText(hDlg10, IDC_EDIT100, buf10);
            while (pbound->TimeDateStamp != 0 && pbound->OffsetModuleName != 0) {
                stamp = pbound->TimeDateStamp;//获取时间戳
                //strftime(stamp, str);//时间戳转时间
                off = pbound->OffsetModuleName;//获取名字偏移地址
                ref = pbound->NumberOfModuleForwarderRefs;//获取依赖dll数

                //printf("\tDllName:%s\n", pFileBuf1 + RVAToFOA(desAddr + off));
                //printf("\t\tTimeDateStamp:[%08XH:%dD]\n", stamp, stamp);
                //printf( "\t\tGMT:%s\n", str);
                //printf("\t\tOffsetModuleName:%04X\n", off);
                //printf("\t\tNumberOfModuleForwarderRefs:[%04XH:%dD]\n", ref, ref);
                wsprintf(str100, "%s\t\t%08XH:%dD\t\t%s\t\t%04XH:%dD\r\n", pFileBuf1 + RVAToFOA(desAddr + off), stamp, stamp, str, off, ref, ref);
                 length10 = strlen(str100) + 1;
                outLength10 = GetWindowTextLength(Edit100);
                buf10 = (TCHAR*)GlobalAlloc(GPTR, outLength10 + length10);
                GetDlgItemText(hDlg10, IDC_EDIT100, buf10, outLength10 + length10);
                _tcscat_s(buf10, outLength10 + length10, str100);
                SetDlgItemText(hDlg10, IDC_EDIT100, buf10);
                IMAGE_BOUND_FORWARDER_REF* boundFor = (IMAGE_BOUND_FORWARDER_REF*)(pbound);
                length10 = strlen("DllName\t\tTimeDateStamp\t\tGMT\t\tOffsetModuleName\t\tReserved\r\n") + 1;
                outLength10 = GetWindowTextLength(Edit101);
                buf11 = (TCHAR*)GlobalAlloc(GPTR, outLength10 + length10);
                GetDlgItemText(hDlg10, IDC_EDIT101, buf10, outLength10 + length10);
                _tcscat_s(buf11, outLength10 + length10, "DllName\t\tTimeDateStamp\t\tGMT\t\tOffsetModuleName\t\tReserved\r\n");
                SetDlgItemText(hDlg10, IDC_EDIT101, buf11);
                for (boundFor++, i = 0; i < ref; i++, boundFor++) {
                    //memset(str, 0, 32);
                    off = boundFor->OffsetModuleName;
                    stamp = boundFor->TimeDateStamp;
                    //TimeDateStampToString(stamp, str);

                  //  printf("\t\t###############################################\n");
                   // printf("\t\tDllName:%s\n", pFileBuf1 + RVAToFOA(desAddr + off));
                    //printf("\t\t\tTimeDateStamp:%08X\n", stamp);
                    //printf("\t\t\tGMT:%s\n", str);
                   // printf("\t\t\tOffsetModuleName:%04X\n", off);
                    //printf("\t\t\tReserved:%04X\n", boundFor->Reserved);
                    wsprintf(str101, "%s\t\t:%08X\t\t%s\t\t%04X\t\t%04X\r\n", pFileBuf1 + RVAToFOA(desAddr + off), stamp, str, off, boundFor->Reserved);
                    length10 = strlen(str101) + 1;
                    outLength10 = GetWindowTextLength(Edit101);
                    buf10 = (TCHAR*)GlobalAlloc(GPTR, outLength10 + length10);
                    GetDlgItemText(hDlg10, IDC_EDIT101, buf10, outLength10 + length10);
                    _tcscat_s(buf10, outLength10 + length10, str100);
                    SetDlgItemText(hDlg10, IDC_EDIT101, buf10);
                }
                pbound = (IMAGE_BOUND_IMPORT_DESCRIPTOR*)(boundFor);//下一个绑定dll

            }
        }

                         break;
        }
    }
    break;
    }
    return (INT_PTR)FALSE;
}


//输入RVA（内存相对偏移地址），返回FOA（文件偏移地址）
DWORD RVAToFOA(DWORD imageAddr){
/*
     * 相对虚拟地址转文件偏移地址
     * ①获取Section数目
     * ②获取SectionAlignment
     * ③判断需要转换的RVA位于哪个Section中(section[n])，
     * offset = 需要转换的RVA-VirtualAddress，计算出RVA相对于本节的偏移地址
     * ④section[n].PointerToRawData + offset就是RVA转换后的FOA
    */
    pSectionHeader = IMAGE_FIRST_SECTION(pNtHeader);
    dwSectionNum = pFileHeader->NumberOfSections;
    //cout << dwSectionNum << endl;
    /*if (imageAddr > dwBytesInBlock) {
        printf("地址错误!%08X\n");

        exit(EXIT_FAILURE);
    }*/
    //cout << hex<<pSectionHeader->PointerToRawData << endl;
    if (imageAddr < pSectionHeader->PointerToRawData) {
        return imageAddr;//在头部（包括节表与对齐）则直接返回
    }

    DWORD offset = 0;
    int i;
    for (i = 0; i < dwSectionNum; i++, pSectionHeader++) {

        DWORD lower = pSectionHeader->VirtualAddress;//该节下限
        DWORD upper = pSectionHeader->VirtualAddress + pSectionHeader->Misc.VirtualSize;//该节上限
        //cout <<hex <<pSectionHeader->VirtualAddress << endl;

        if (imageAddr >= lower && imageAddr <= upper) {
            offset = imageAddr - lower + pSectionHeader->PointerToRawData;//计算出RVA的FOA
            break;
        }
    }
    return offset;
}
//导出表
INT_PTR CALLBACK ExpDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:

    case WM_COMMAND:

        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;


    }
    return (INT_PTR)FALSE;
}
//导入表
INT_PTR CALLBACK ImpDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:

    case WM_COMMAND:

        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;
    }
    return (INT_PTR)FALSE;
}
//重定位表
INT_PTR CALLBACK RecDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:
    case WM_CREATE:

    case WM_COMMAND:

        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;
    }
    return (INT_PTR)FALSE;
}

//资源表
INT_PTR CALLBACK ResDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:

    case WM_COMMAND:

        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;
    }
    return (INT_PTR)FALSE;
}
//IAT
INT_PTR CALLBACK IATDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:

    case WM_COMMAND:

        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;
    }
    return (INT_PTR)FALSE;
}
INT_PTR CALLBACK BoundDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam) {
    UNREFERENCED_PARAMETER(lParam);
    switch (message) {
        //case WM_INITDIALOG:

    case WM_COMMAND:

        if (LOWORD(wParam) == IDCANCEL) {
            DestroyWindow(hDlg);
            //return (INT_PTR)TRUE;
        }
        break;
    }
    return (INT_PTR)FALSE;
}
